GAAS vs. GAGAS: How to Report on Internal Controls

The procedures relating to the internal control structure for a generally accepted auditing standards (GAAS) audit are the same as those for an audit conducted under generally accepted government auditing standards (GAGAS). Only the report is different. There are 3 basic sources of guidance in these areas: 1. Statement on Auditing Standards (SAS) 60, 2. Government Auditing Standards (the yellow book), issued by the US General Accounting Office, and 3. SAS 63. SAS 60 addresses the auditor's responsibility for communicating internal control structure matters noted during the course of the audit. Although the yellow book does not provide specific examples of the communications of matters related to internal control structure, its requirements in some respects are more extensive than GAAS. SAS 63 provides guidance on how auditors should modify SAS 60 reports on the internal control structure to meet the requirements of the yellow book.